dd-trace 5.57.1 → 5.59.0

package/packages/dd-trace/src/appsec/iast/vulnerabilities.js

@@ -1,3 +1,5 @@
+'use strict'
+
 module.exports = {
   COMMAND_INJECTION: 'COMMAND_INJECTION',
   CODE_INJECTION: 'CODE_INJECTION',

package/packages/dd-trace/src/appsec/iast/vulnerability-reporter.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const LRU = require('lru-cache')
+const { LRUCache } = require('lru-cache')
 const vulnerabilitiesFormatter = require('./vulnerabilities-formatter')
 const { IAST_ENABLED_TAG_KEY, IAST_JSON_TAG_KEY } = require('./tags')
 const { keepTrace } = require('../../priority_sampler')
@@ -10,7 +10,7 @@ const { ASM } = require('../../standalone/product')
 
 const VULNERABILITIES_KEY = 'vulnerabilities'
 const VULNERABILITY_HASHES_MAX_SIZE = 1000
-const VULNERABILITY_HASHES = new LRU({ max: VULNERABILITY_HASHES_MAX_SIZE })
+const VULNERABILITY_HASHES = new LRUCache({ max: VULNERABILITY_HASHES_MAX_SIZE })
 const RESET_VULNERABILITY_CACHE_INTERVAL = 60 * 60 * 1000 // 1 hour
 
 let tracer
@@ -114,7 +114,7 @@ function isDuplicatedVulnerability (vulnerability) {
 }
 
 function getVulnerabilityCallSiteFrames () {
-  return getCallsiteFrames(stackTraceMaxDepth)
+  return getCallsiteFrames(stackTraceMaxDepth, getVulnerabilityCallSiteFrames)
 }
 
 function replaceCallSiteFromSourceMap (callsite) {

package/packages/dd-trace/src/appsec/rasp/fs-plugin.js

@@ -14,25 +14,31 @@ const enabledFor = {
 
 let fsPlugin
 
-function enterWith (fsProps, store = storage('legacy').getStore()) {
+function getStoreToStart (fsProps, store = storage('legacy').getStore()) {
   if (store && !store.fs?.opExcluded) {
-    storage('legacy').enterWith({
+    return {
       ...store,
       fs: {
         ...store.fs,
         ...fsProps,
         parentStore: store
       }
-    })
+    }
   }
+
+  return store
 }
 
 class AppsecFsPlugin extends Plugin {
   enable () {
-    this.addSub('apm:fs:operation:start', this._onFsOperationStart)
-    this.addSub('apm:fs:operation:finish', this._onFsOperationFinishOrRenderEnd)
-    this.addSub('tracing:datadog:express:response:render:start', this._onResponseRenderStart)
-    this.addSub('tracing:datadog:express:response:render:end', this._onFsOperationFinishOrRenderEnd)
+    this.addBind('apm:fs:operation:start', this._onFsOperationStart)
+    this.addBind('apm:fs:operation:finish', this._onFsOperationFinishOrRenderEnd)
+    this.addBind('tracing:datadog:express:response:render:start', this._onResponseRenderStart)
+    this.addBind('tracing:datadog:express:response:render:end', this._onFsOperationFinishOrRenderEnd)
+    // TODO Remove this when dc-polyfill is fixed&updated
+    //  hack to node 18 and early 20.x
+    //  with dc-polyfill addBind is not enough to force a channel.hasSubscribers === true
+    this.addSub('tracing:datadog:express:response:render:start', () => {})
 
     super.configure(true)
   }
@@ -44,19 +50,20 @@ class AppsecFsPlugin extends Plugin {
   _onFsOperationStart () {
     const store = storage('legacy').getStore()
     if (store) {
-      enterWith({ root: store.fs?.root === undefined }, store)
+      return getStoreToStart({ root: store.fs?.root === undefined }, store)
     }
   }
 
   _onResponseRenderStart () {
-    enterWith({ opExcluded: true })
+    return getStoreToStart({ opExcluded: true })
   }
 
   _onFsOperationFinishOrRenderEnd () {
     const store = storage('legacy').getStore()
-    if (store?.fs?.parentStore) {
-      storage('legacy').enterWith(store.fs.parentStore)
+    if (store?.fs) {
+      return store.fs.parentStore
     }
+    return store
   }
 }
 

package/packages/dd-trace/src/appsec/rasp/utils.js

@@ -41,7 +41,7 @@ function handleResult (result, req, res, abortController, config, raspRule) {
   const ruleTriggered = !!result?.events?.length
 
   if (generateStackTraceAction && enabled && canReportStackTrace(rootSpan, maxStackTraces)) {
-    const frames = getCallsiteFrames(maxDepth)
+    const frames = getCallsiteFrames(maxDepth, handleResult)
 
     reportStackTrace(
       rootSpan,

package/packages/dd-trace/src/appsec/recommended.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.14.2"
+    "rules_version": "1.15.0"
   },
   "rules": [
     {
@@ -2985,7 +2985,7 @@
                 "address": "graphql.server.resolver"
               }
             ],
-            "regex": "\\b(?:(?:l(?:(?:utimes|chmod)(?:Sync)?|(?:stat|ink)Sync)|w(?:rite(?:(?:File|v)(?:Sync)?|Sync)|atchFile)|u(?:n(?:watchFile|linkSync)|times(?:Sync)?)|s(?:(?:ymlink|tat)Sync|pawn(?:File|Sync))|ex(?:ec(?:File(?:Sync)?|Sync)|istsSync)|a(?:ppendFile|ccess)(?:Sync)?|(?:Caveat|Inode)s|open(?:dir)?Sync|new\\s+Function|Availability|\\beval)\\s*\\(|m(?:ain(?:Module\\s*(?:\\W*\\s*(?:constructor|require)|\\[)|\\s*(?:\\W*\\s*(?:constructor|require)|\\[))|kd(?:temp(?:Sync)?|irSync)\\s*\\(|odule\\.exports\\s*=)|c(?:(?:(?:h(?:mod|own)|lose)Sync|reate(?:Write|Read)Stream|p(?:Sync)?)\\s*\\(|o(?:nstructor\\s*(?:\\W*\\s*_load|\\[)|pyFile(?:Sync)?\\s*\\())|f(?:(?:(?:s(?:(?:yncS)?|tatS)|datas(?:yncS)?)ync|ch(?:mod|own)(?:Sync)?)\\s*\\(|u(?:nction\\s*\\(\\s*\\)\\s*{|times(?:Sync)?\\s*\\())|r(?:e(?:(?:ad(?:(?:File|link|dir)?Sync|v(?:Sync)?)|nameSync)\\s*\\(|quire\\s*(?:\\W*\\s*main|\\[))|m(?:Sync)?\\s*\\()|process\\s*(?:\\W*\\s*(?:mainModule|binding)|\\[)|t(?:his\\.constructor|runcateSync\\s*\\()|_(?:\\$\\$ND_FUNC\\$\\$_|_js_function)|global\\s*(?:\\W*\\s*process|\\[)|String\\s*\\.\\s*fromCharCode|binding\\s*\\[)",
+            "regex": "\\b(?:(?:l(?:(?:utimes|chmod)(?:Sync)?|(?:stat|ink)Sync)|w(?:rite(?:(?:File|v)(?:Sync)?|Sync)|atchFile)|u(?:n(?:watchFile|linkSync)|times(?:Sync)?)|s(?:(?:ymlink|tat)Sync|pawn(?:File|Sync))|ex(?:ec(?:File(?:Sync)?|Sync)|istsSync)|a(?:ppendFile|ccess)(?:Sync)?|(?:Caveat|Inode)s|open(?:dir)?Sync|new\\s+Function|Availability|\\beval)\\s*\\(|m(?:ain(?:Module\\s*(?:\\W*\\s*(?:constructor|require)|\\[)|\\s*(?:\\W*\\s*(?:constructor|require)|\\[))|kd(?:temp(?:Sync)?|irSync)\\s*\\(|odule\\.exports\\s*=)|c(?:(?:(?:h(?:mod|own)|lose)Sync|reate(?:Write|Read)Stream|p(?:Sync)?)\\s*\\(|o(?:nstructor\\s*(?:\\W*\\s*_load|\\[)|pyFile(?:Sync)?\\s*\\())|f(?:(?:(?:s(?:(?:yncS)?|tatS)|datas(?:yncS)?)ync|ch(?:mod|own)(?:Sync)?)\\s*\\(|u(?:nction\\s*\\(\\s*\\)\\s*{|times(?:Sync)?\\s*\\())|r(?:e(?:(?:ad(?:(?:File|link|dir)?Sync|v(?:Sync)?)|nameSync)\\s*\\(|quire\\s*(?:\\W*\\s*main\\b|\\[))|m(?:Sync)?\\s*\\()|process\\s*(?:\\W*\\s*(?:mainModule|binding)|\\[)|t(?:his\\.constructor|runcateSync\\s*\\()|_(?:\\$\\$ND_FUNC\\$\\$_|_js_function)|global\\s*(?:\\W*\\s*process|\\[)|String\\s*\\.\\s*fromCharCode|binding\\s*\\[)",
             "options": {
               "case_sensitive": true,
               "min_length": 3
@@ -5656,6 +5656,52 @@
       ],
       "transformers": []
     },
+    {
+      "id": "dog-932-110",
+      "name": "Python: Subprocess-based command injection",
+      "tags": {
+        "type": "command_injection",
+        "category": "attack_attempt",
+        "confidence": "0",
+        "module": "waf"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.query"
+              },
+              {
+                "address": "server.request.body"
+              },
+              {
+                "address": "server.request.path_params"
+              },
+              {
+                "address": "server.request.headers.no_cookies"
+              },
+              {
+                "address": "grpc.server.request.message"
+              },
+              {
+                "address": "graphql.server.all_resolvers"
+              },
+              {
+                "address": "graphql.server.resolver"
+              }
+            ],
+            "regex": "(?s)\\bsubprocess\\b.*\\b(?:check_output|run|Popen|call|check_call)\\b",
+            "options": {
+              "case_sensitive": true,
+              "min_length": 14
+            }
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
     {
       "id": "dog-934-001",
       "name": "XXE - XML file loads external entity",
@@ -9074,6 +9120,28 @@
       "evaluate": true,
       "output": true
     },
+    {
+      "id": "decode-auth-jwt",
+      "generator": "jwt_decode",
+      "min_version": "1.25.0",
+      "parameters": {
+        "mappings": [
+          {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "authorization"
+                ]
+              }
+            ],
+            "output": "server.request.jwt"
+          }
+        ]
+      },
+      "evaluate": true,
+      "output": false
+    },
     {
       "id": "http-network-fingerprint",
       "generator": "http_network_fingerprint",
@@ -9918,6 +9986,24 @@
         "category": "payment"
       }
     },
+    {
+      "id": "c542c147-3883-43d6-a067-178e4a7bd65d",
+      "name": "Password",
+      "key": {
+        "operator": "match_regex",
+        "parameters": {
+          "regex": "\\bpass(?:[_-]?word|wd)?\\b|\\bpwd\\b",
+          "options": {
+            "case_sensitive": false,
+            "min_length": 3
+          }
+        }
+      },
+      "tags": {
+        "type": "password",
+        "category": "credentials"
+      }
+    },
     {
       "id": "18b608bd7a764bff5b2344c0",
       "name": "Phone number",

package/packages/dd-trace/src/appsec/reporter.js

@@ -1,5 +1,8 @@
 'use strict'
 
+const dc = require('dc-polyfill')
+const zlib = require('zlib')
+
 const Limiter = require('../rate_limiter')
 const { storage } = require('../../../datadog-core')
 const web = require('../plugins/util/web')
@@ -7,6 +10,7 @@ const { ipHeaderList } = require('../plugins/util/ip_extractor')
 const {
   incrementWafInitMetric,
   incrementWafUpdatesMetric,
+  incrementWafConfigErrorsMetric,
   incrementWafRequestsMetric,
   updateWafRequestsMetricTags,
   updateRaspRequestsMetricTags,
@@ -14,9 +18,9 @@ const {
   updateRateLimitedMetric,
   getRequestMetrics
 } = require('./telemetry')
-const zlib = require('zlib')
 const { keepTrace } = require('../priority_sampler')
 const { ASM } = require('../standalone/product')
+const { DIAGNOSTIC_KEYS } = require('./waf/diagnostics')
 
 const REQUEST_HEADER_TAG_PREFIX = 'http.request.headers.'
 const RESPONSE_HEADER_TAG_PREFIX = 'http.response.headers.'
@@ -25,6 +29,8 @@ const COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH = 4096
 const COLLECTED_REQUEST_BODY_MAX_DEPTH = 20
 const COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE = 256
 
+const telemetryLogCh = dc.channel('datadog:telemetry:log')
+
 // default limiter, configurable with setRateLimit()
 let limiter = new Limiter(100)
 
@@ -216,17 +222,64 @@ function getCollectedHeaders (req, res, shouldCollectEventHeaders, storedRespons
 function reportWafInit (wafVersion, rulesVersion, diagnosticsRules = {}, success = false) {
   if (success) {
     metricsQueue.set('_dd.appsec.waf.version', wafVersion)
-
-    metricsQueue.set('_dd.appsec.event_rules.loaded', diagnosticsRules.loaded?.length || 0)
-    metricsQueue.set('_dd.appsec.event_rules.error_count', diagnosticsRules.failed?.length || 0)
-    if (diagnosticsRules.failed?.length) {
-      metricsQueue.set('_dd.appsec.event_rules.errors', JSON.stringify(diagnosticsRules.errors))
-    }
   }
 
   incrementWafInitMetric(wafVersion, rulesVersion, success)
 }
 
+function logWafDiagnosticMessage (product, rcConfigId, configKey, message, level) {
+  const tags =
+    `log_type:rc::${product.toLowerCase()}::diagnostic,appsec_config_key:${configKey},rc_config_id:${rcConfigId}`
+  telemetryLogCh.publish({
+    message,
+    level,
+    tags
+  })
+}
+
+function reportWafConfigUpdate (product, rcConfigId, diagnostics, wafVersion) {
+  if (diagnostics.error) {
+    logWafDiagnosticMessage(product, rcConfigId, '', diagnostics.error, 'ERROR')
+    incrementWafConfigErrorsMetric(wafVersion, diagnostics.ruleset_version)
+  }
+
+  for (const configKey of DIAGNOSTIC_KEYS) {
+    const configDiagnostics = diagnostics[configKey]
+    if (!configDiagnostics) continue
+
+    if (configDiagnostics.error) {
+      logWafDiagnosticMessage(product, rcConfigId, configKey, configDiagnostics.error, 'ERROR')
+      incrementWafConfigErrorsMetric(wafVersion, diagnostics.ruleset_version)
+      continue
+    }
+
+    if (configDiagnostics.errors) {
+      for (const [errorMessage, errorIds] of Object.entries(configDiagnostics.errors)) {
+        logWafDiagnosticMessage(
+          product,
+          rcConfigId,
+          configKey,
+          `"${errorMessage}": ${JSON.stringify(errorIds)}`,
+          'ERROR'
+        )
+        incrementWafConfigErrorsMetric(wafVersion, diagnostics.ruleset_version)
+      }
+    }
+
+    if (configDiagnostics.warnings) {
+      for (const [warningMessage, warningIds] of Object.entries(configDiagnostics.warnings)) {
+        logWafDiagnosticMessage(
+          product,
+          rcConfigId,
+          configKey,
+          `"${warningMessage}": ${JSON.stringify(warningIds)}`,
+          'WARN'
+        )
+      }
+    }
+  }
+}
+
 function reportMetrics (metrics, raspRule) {
   const store = storage('legacy').getStore()
   const rootSpan = store?.req && web.root(store.req)
@@ -377,12 +430,12 @@ function isRaspAttack (events) {
   return events.some(e => e.rule?.tags?.module === 'rasp')
 }
 
-function isFingerprintDerivative (derivative) {
-  return derivative.startsWith('_dd.appsec.fp')
+function isFingerprintAttribute (attribute) {
+  return attribute.startsWith('_dd.appsec.fp')
 }
 
-function reportDerivatives (derivatives) {
-  if (!derivatives) return
+function reportAttributes (attributes) {
+  if (!attributes) return
 
   const req = storage('legacy').getStore()?.req
   const rootSpan = web.root(req)
@@ -390,8 +443,8 @@ function reportDerivatives (derivatives) {
   if (!rootSpan) return
 
   const tags = {}
-  for (let [tag, value] of Object.entries(derivatives)) {
-    if (!isFingerprintDerivative(tag)) {
+  for (let [tag, value] of Object.entries(attributes)) {
+    if (!isFingerprintAttribute(tag)) {
       const gzippedValue = zlib.gzipSync(JSON.stringify(value))
       value = gzippedValue.toString('base64')
     }
@@ -485,11 +538,12 @@ module.exports = {
   filterExtendedHeaders,
   formatHeaderName,
   reportWafInit,
+  reportWafConfigUpdate,
   reportMetrics,
   reportAttack,
   reportWafUpdate: incrementWafUpdatesMetric,
   reportRaspRuleSkipped: updateRaspRuleSkippedMetricTags,
-  reportDerivatives,
+  reportAttributes,
   finishRequest,
   mapHeaderAndTags,
   truncateRequestBody

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -2,21 +2,22 @@
 
 const fs = require('fs')
 const waf = require('./waf')
+const { DIAGNOSTIC_KEYS } = require('./waf/diagnostics')
 const { ACKNOWLEDGED, ERROR } = require('../remote_config/apply_states')
+const Reporter = require('./reporter')
 
 const blocking = require('./blocking')
 
-let defaultRules
+const ASM_PRODUCTS = new Set(['ASM', 'ASM_DD', 'ASM_DATA'])
 
-let appliedRulesData = new Map()
-let appliedRulesetId
-let appliedRulesOverride = new Map()
-let appliedExclusions = new Map()
-let appliedCustomRules = new Map()
+/*
+  ASM Actions must be tracked in order to update the defaultBlockingActions in blocking. These actions are used
+  by blockRequest method exposed in the user blocking SDK (see packages/dd-trace/src/appsec/sdk/user_blocking.js)
+ */
 let appliedActions = new Map()
 
 function loadRules (config) {
-  defaultRules = config.rules
+  const defaultRules = config.rules
     ? JSON.parse(fs.readFileSync(config.rules))
     : require('./recommended.json')
 
@@ -26,137 +27,63 @@ function loadRules (config) {
 }
 
 function updateWafFromRC ({ toUnapply, toApply, toModify }) {
-  const batch = new Set()
-
-  const newRulesData = new SpyMap(appliedRulesData)
-  let newRuleset
-  let newRulesetId
-  const newRulesOverride = new SpyMap(appliedRulesOverride)
-  const newExclusions = new SpyMap(appliedExclusions)
-  const newCustomRules = new SpyMap(appliedCustomRules)
   const newActions = new SpyMap(appliedActions)
 
+  let wafUpdated = false
+  let wafUpdatedFailed = false
+
   for (const item of toUnapply) {
-    const { product, id } = item
+    if (!ASM_PRODUCTS.has(item.product)) continue
+
+    try {
+      waf.removeConfig(item.path)
+
+      item.apply_state = ACKNOWLEDGED
+      wafUpdated = true
 
-    if (product === 'ASM_DATA') {
-      newRulesData.delete(id)
-    } else if (product === 'ASM_DD') {
-      if (appliedRulesetId === id) {
-        newRuleset = defaultRules
+      // ASM actions
+      if (item.product === 'ASM') {
+        newActions.delete(item.id)
       }
-    } else if (product === 'ASM') {
-      newRulesOverride.delete(id)
-      newExclusions.delete(id)
-      newCustomRules.delete(id)
-      newActions.delete(id)
+    } catch (e) {
+      item.apply_state = ERROR
+      item.apply_error = e.toString()
+      wafUpdatedFailed = true
     }
   }
 
   for (const item of [...toApply, ...toModify]) {
-    const { product, id, file } = item
-
-    if (product === 'ASM_DATA') {
-      if (file && file.rules_data && file.rules_data.length) {
-        newRulesData.set(id, file.rules_data)
-      }
-
-      batch.add(item)
-    } else if (product === 'ASM_DD') {
-      if (appliedRulesetId && appliedRulesetId !== id && newRuleset !== defaultRules) {
-        item.apply_state = ERROR
-        item.apply_error = 'Multiple ruleset received in ASM_DD'
-      } else {
-        if (file?.rules?.length) {
-          const { version, metadata, rules, processors, scanners } = file
-
-          newRuleset = { version, metadata, rules, processors, scanners }
-          newRulesetId = id
-        }
-
-        batch.add(item)
-      }
-    } else if (product === 'ASM') {
-      if (file?.rules_override?.length) {
-        newRulesOverride.set(id, file.rules_override)
-      }
+    if (!ASM_PRODUCTS.has(item.product)) continue
 
-      if (file?.exclusions?.length) {
-        newExclusions.set(id, file.exclusions)
-      }
+    try {
+      waf.updateConfig(item.product, item.id, item.path, item.file)
 
-      if (file?.custom_rules?.length) {
-        newCustomRules.set(id, file.custom_rules)
-      }
+      item.apply_state = ACKNOWLEDGED
+      wafUpdated = true
 
-      if (file?.actions?.length) {
-        newActions.set(id, file.actions)
+      // ASM actions
+      if (item.product === 'ASM' && item.file?.actions?.length) {
+        newActions.set(item.id, item.file.actions)
       }
-
-      batch.add(item)
+    } catch (e) {
+      item.apply_state = ERROR
+      item.apply_error = e instanceof waf.WafUpdateError
+        ? JSON.stringify(extractErrors(e.diagnosticErrors))
+        : e.toString()
+      wafUpdatedFailed = true
     }
   }
 
-  let newApplyState = ACKNOWLEDGED
-  let newApplyError
-
-  if (newRulesData.modified ||
-    newRuleset ||
-    newRulesOverride.modified ||
-    newExclusions.modified ||
-    newCustomRules.modified ||
-    newActions.modified
-  ) {
-    const payload = newRuleset || {}
-
-    if (newRulesData.modified) {
-      payload.rules_data = mergeRulesData(newRulesData)
-    }
-    if (newRulesOverride.modified) {
-      payload.rules_override = concatArrays(newRulesOverride)
-    }
-    if (newExclusions.modified) {
-      payload.exclusions = concatArrays(newExclusions)
-    }
-    if (newCustomRules.modified) {
-      payload.custom_rules = concatArrays(newCustomRules)
-    }
-    if (newActions.modified) {
-      payload.actions = concatArrays(newActions)
-    }
-
-    try {
-      waf.update(payload)
-
-      if (newRulesData.modified) {
-        appliedRulesData = newRulesData
-      }
-      if (newRuleset) {
-        appliedRulesetId = newRulesetId
-      }
-      if (newRulesOverride.modified) {
-        appliedRulesOverride = newRulesOverride
-      }
-      if (newExclusions.modified) {
-        appliedExclusions = newExclusions
-      }
-      if (newCustomRules.modified) {
-        appliedCustomRules = newCustomRules
-      }
-      if (newActions.modified) {
-        appliedActions = newActions
+  waf.checkAsmDdFallback()
 
-        blocking.setDefaultBlockingActionParameters(concatArrays(newActions))
-      }
-    } catch (err) {
-      newApplyState = ERROR
-      newApplyError = err.toString()
-    }
+  if (wafUpdated) {
+    Reporter.reportWafUpdate(waf.wafManager.ddwafVersion, waf.wafManager.rulesVersion, !wafUpdatedFailed)
   }
 
-  for (const config of batch) {
-    config.apply_state = newApplyState
-    if (newApplyError) config.apply_error = newApplyError
+  // Manage blocking actions
+  if (newActions.modified) {
+    appliedActions = newActions
+    blocking.setDefaultBlockingActionParameters(concatArrays(newActions))
   }
 }
 
@@ -188,67 +115,32 @@ function concatArrays (files) {
   return [...files.values()].flat()
 }
 
-/*
-  ASM_DATA Merge strategy:
-  The merge should be based on the id and type. For any duplicate items, the longer expiration should be taken.
-  As a result, multiple Rule Data may use the same DATA_ID and DATA_TYPE. In this case, all values are considered part
-  of a set and are merged. For instance, a denylist customized by environment may use a global Rule Data for all
-  environments and a Rule Data per environment
-*/
-
-function mergeRulesData (files) {
-  const mergedRulesData = new Map()
-  for (const [, file] of files) {
-    for (const ruleData of file) {
-      const key = `${ruleData.id}+${ruleData.type}`
-      if (mergedRulesData.has(key)) {
-        const existingRulesData = mergedRulesData.get(key)
-        ruleData.data.reduce(rulesReducer, existingRulesData.data)
-      } else {
-        mergedRulesData.set(key, copyRulesData(ruleData))
-      }
+function extractErrors (diagnostics) {
+  if (!diagnostics) return
+
+  if (diagnostics.error) return diagnostics
+
+  const result = {}
+  let isResultPopulated = false
+
+  for (const diagnosticKey of DIAGNOSTIC_KEYS) {
+    if (diagnostics[diagnosticKey]?.error) {
+      (result[diagnosticKey] ??= {}).error = diagnostics[diagnosticKey]?.error
+      isResultPopulated = true
     }
-  }
-  return [...mergedRulesData.values()]
-}
 
-function rulesReducer (existingEntries, rulesDataEntry) {
-  const existingEntry = existingEntries.find((entry) => entry.value === rulesDataEntry.value)
-  if (existingEntry && !('expiration' in existingEntry)) return existingEntries
-  if (existingEntry && 'expiration' in rulesDataEntry && rulesDataEntry.expiration > existingEntry.expiration) {
-    existingEntry.expiration = rulesDataEntry.expiration
-  } else if (existingEntry && !('expiration' in rulesDataEntry)) {
-    delete existingEntry.expiration
-  } else if (!existingEntry) {
-    existingEntries.push({ ...rulesDataEntry })
+    if (diagnostics[diagnosticKey]?.errors) {
+      (result[diagnosticKey] ??= {}).errors = diagnostics[diagnosticKey]?.errors
+      isResultPopulated = true
+    }
   }
-  return existingEntries
-}
 
-function copyRulesData (rulesData) {
-  const copy = { ...rulesData }
-  if (copy.data) {
-    const data = []
-    copy.data.forEach(item => {
-      data.push({ ...item })
-    })
-    copy.data = data
-  }
-  return copy
+  return isResultPopulated ? result : null
 }
 
 function clearAllRules () {
   waf.destroy()
-
-  defaultRules = undefined
-
-  appliedRulesData.clear()
-  appliedRulesetId = undefined
-  appliedRulesOverride.clear()
-  appliedExclusions.clear()
-  appliedCustomRules.clear()
   appliedActions.clear()
-
   blocking.setDefaultBlockingActionParameters(undefined)
 }